Overview

overview

7

Static

static

3

2026-06-08...di.exe

windows10-2004-x64

7

2026-06-08...di.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    08/06/2026, 15:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-08_60b0055f33c3c7b1e9e4818b18838f61_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedi.exe
  • Size 11.3MB
  • Sample260608-sn66aagx2x
  • SHA256 1afeee2f736b594b5c2cda7aee83f6c959cdc4c4014c57515c9713d3887091d7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-08_60b0055f33c3c7b1e9e4818b18838f61_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedi.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-08_60b0055f33c3c7b1e9e4818b18838f61_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedi.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1252
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4388
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4024
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3512

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 11.8MB
        • SHA256 541e4e975260bd5392ffb2947d600d140af26ab20740ff376e9b8b149e93e937
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 12.2MB
        • SHA256 702ba2577e423394bbfd81d040ecb7329130f9930e713ba0a73631b0bee07758
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 12.0MB
        • SHA256 357ea213903333200b6ff8108a5a3165f7e388e5ac98af34bd5abddb2f185483
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 11.3MB
        • SHA256 515130989bc8161e64b94e8ba9de93d9d8fad8d9d4d5515e2fbe623655f59470
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 17.3MB
        • SHA256 3e0726fbbe96a06c183ca75b976fde1eceb39493e934f30c2b3e35a9a3a97c88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 13.0MB
        • SHA256 dfbe064bba0423d18ab905eff0d3fee167fbea389c26b267c65cfc9c08401a29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 14.8MB
        • SHA256 9a08fbbaeb6b45c7dd37b4ea52c513abe37960fccaa87fa1a02dde99353961df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 13.6MB
        • SHA256 aaaad5e268a0a0734c3c9f95449b1e6d5be6b627558e2ad4ad07a98c12f6583d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 12.9MB
        • SHA256 38336d4ad32b24d172f78cb13a34b8410506e7fb594c69fe6d92964f8b5c0ab4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 13.1MB
        • SHA256 30953da124c7c0dbf4eeb40b443e72b0712a3191602e3e7f74adb62eae933aea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 14.4MB
        • SHA256 34559a12e9f63fb72e121e0f600b62daa4c2d6725bb4bd035e34012d69a15a4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 12.7MB
        • SHA256 2312a3ec7fa18106e47bb3d2bf3a17192726c5e8ec7029319c4dc63cd88833fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 11.3MB
        • SHA256 c753751aec367965119cb24f5252ad7b266e581aee9d4589f8fa33aefaa115c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 11.3MB
        • SHA256 eafbddb86bd4381f6b04e05213f3d1b6e8cf1f5eb04af02343001949b174adf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 11.3MB
        • SHA256 d6bfe3d2c1328a96f98033a5a72d3e407143bb0361f520b78d88b8f04d4c670b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 11.3MB
        • SHA256 1f5c5ca062c82dfffe72ab349bf10b82a93e100f5d783b60000376bbed6d5f17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 11.3MB
        • SHA256 25d7947eb9f917a0a5476ea7ff6c8d445a5701c1a96fee99cc9d84d28a45fc9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 11.3MB
        • SHA256 105866ae0c6ce0cb1135036f877aed696a3da82b71ba0e3c0f52fe24e4b2ed0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 11.4MB
        • SHA256 708d3fef0b61b49d008a4d8b82fdaca7f15858a5cb2b3fdfd75b6dd867c60028
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 11.3MB
        • SHA256 1a69769ccc378afc5dbad0745e44869f82eb31a0f8e9bb4cd9de7bae69922c1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 11.4MB
        • SHA256 73bc40e4139e0f3fa4d2a1933c1e49096112e8188a5fb9c253858754e29c75a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 11.3MB
        • SHA256 a19d23a353cc5ad49454d14f76cff76a4153ab83d03aecdab638f32437dd1978
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 11.3MB
        • SHA256 1afeee2f736b594b5c2cda7aee83f6c959cdc4c4014c57515c9713d3887091d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.3MB
        • SHA256 e1b58dc4aeb01c5ffc6e0caf90c839db619357e870e18fd0abdaa3829ca51c2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.3MB
        • SHA256 200b858912c923073f2b0596ec58c351f117b90059f1a733467f8b9d4fe90d2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.3MB
        • SHA256 f902d37e261a10d3420902e431e7727dae358a6b3826ce6eceed139fb89be6d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.3MB
        • SHA256 0a563b29091b1616e8e923baac07d4ac9ba8ce91171af5b77d05108bf855d300
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.3MB
        • SHA256 b95dbf34aa90a451822e47a419f3c0813bdc8c8ad6398e8242a0481e68497868
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.3MB
        • SHA256 09880c2f3b366777ab541567180b611826cf1424094b11eb217b9ea201ef2e4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.3MB
        • SHA256 bb7a3a104011cd0b642bf7fe8bfaa5aeac028392c84403d11f1f4236dbf8cf7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.3MB
        • SHA256 7a13cefc163cd2be305d1c484236660de2cc93b2c279033118e8086dd2a3c466
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 11.3MB
        • SHA256 018510e59af19680dac17b8490115d2cc36c13868b3ff21c51794077fce012f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download